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Internet Association Submission To ICO Age Appropriate Design Code 
Consultation 


1. Introduction 


Internet Association (“IA”) welcomes the opportunity to respond to the Information Commissioner’s 
Office (“ICO”) consultation on a draft Age Appropriate Design Code (the “draft Code”). 


IA represents over 40 of the world’s leading internet companies.’ IA is the only trade association that 
exclusively represents leading global internet companies on matters of public policy. IA’s mission is to 
foster innovation, promote economic growth, and empower people through the free and open internet — 
in November 2018 IA established a London office to constructively engage in the internet public policy 
debate in the UK. 


We are firm believers in the benefits that technology brings to everyday life and the economy, and for 
the potential that internet innovation has to transform society for the better. IA economic analysis 
shows that the internet sector contributes £45 billion to the UK economy each year, and is responsible 
for nearly 80,000 businesses and around 400,000 jobs. Recent IA polling found that 82 percent of 
British people believe that the internet had “made their lives easier and more enjoyable”. 


IA believes that the internet sector needs a balanced policy and regulatory environment to continue, and 
grow, its contribution to the UK economy, consumers, and society in the future. The internet will drive 
21st century prosperity, but there is a risk to this potential if policies and regulation is introduced — such 
as the draft Code in its proposed form — which will damage the ability of the internet sector to: 1) drive 
UK economic growth; and 2) provide services that people, including children, value highly. 


2. Internet Industry Concerns With The Draft Code 


Internet companies support the ambition of better protecting children’s personal data online, and want 
to work with policymakers and regulators to achieve this aim while also enabling the internet to continue 
providing benefits to the economy, consumers (including children) and society. In this context, IA has 
the following concerns with the draft Code. 


2.1 Disproportionate And Unclear Scope 


The draft Code applies to “information society services likely to be accessed by children” in the UK, and 
the ICO notes that the draft Code is not restricted to services specifically directed at children. Further, 
the draft Code states that companies should “apply the standards in this code to all users, unless you 
have robust age-verification mechanisms to distinguish adults from children”. 


IA is concerned that the scope of the draft Code is too broad and disproportionate to the policy issue 
that it is seeking to address — safeguarding children’s personal data. The requirement to apply the draft 
Code’s obligations to services that are “likely to be accessed by children” will capture an extremely 
wide set of internet services. In effect, this will mean the draft Code will cover services that are “able to 
be accessed by children”, which is far beyond the intended scope and will cover services that are used 
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predominantly by adults. 


We are also concerned about scope inconsistency between the draft Code and both GDPR and the Data 
Protection Act 2018 (“DPA18”). GDPR does not define a “child”, although there is an implicit recognition 
within Article 8 that at age 16 parental responsibility will fall away, given from that age parental consent 
does not have a role to play in providing lawful grounds for the processing of the data of a child. Article 
8.1 allows a Member State to determine that the ability of a child to think for itself in the context of an 
information society service may be lower, a step the UK took by placing the threshold where, in effect, a 
child’s own reasoning power must be replaced by that of the parent at below age 13 (the lowest age 
possible). It therefore appears inconsistent with the aims and objectives of GDPR and DPA18 to set 
wider standards capable of being interpreted as applying to anyone up to the age of 18. Put differently, 
we believe it is inconsistent for UK law to state that a 13-18 year old can give consent by themselves, 
but for the draft Code to take the position that a 13-18 year old cannot understand enough about an 
online service such that, for example, personalisation/profiling may be switched on by default. 


On the issue of scope clarity, “likely to be accessed” is an unclear legal concept which creates 
uncertainty for business. What is to be considered “likely” will be clear in some cases and subjective in 
others. The draft Code also refers both to services “likely to be accessed by children” and “likely to be 
used by under 18s”. These terms are not directly the same, creating further uncertainty. There is also 
uncertainty as to when a service would be deemed to be accessed by a “significant number of children — 
even if this is only a small proportion of [a service’s] overall user base”, and this issue with lack of clarity 
would also apply between the various age—brackets for children set out by the ICO (e.g. 13+ vs 10+ etc). 


The draft Code’s requirement to apply its standards to all users, unless age-verification is used, also 
means that it will have a disproportionate impact. While the draft Code states that age-verification is 
part of the solution, recent experience in the UK shows that age-verification is a complicated policy 
issue. At this point in time, for a range of technical, operational and legal reasons, it is not feasible or 
desirable to put in place the required age-verification mechanisms to distinguish adults from children 
across a wide range of online services. The ICO recognises in the draft Code that “age-verification tools 
are still a developing area” where “clear industry standards” are not yet established. The unintended 
consequence of these requirements is that adults’ use of the internet will be over—regulated by the draft 
Code. 


The issue of scope raises wider questions about how we approach internet regulation. The proposed 
Code appears to start from the presumption that all internet users are children and need to be protected 
from content. As we continue to live more of our lives online, this approach seems out of step with how 
we approach regulation and responsibility in the real-world. While there may be some areas online that 
should require age-verification, such as sites related to the purchase of alcohol, weapons and 
pornography, to make this the norm for all internet sites is a fundamental shift. 


Recommendation: Given the concerns set out above, IA believes that a more proportionate approach 
would be for scope to be set by determining whether a service is “targeted at children” (“children” 
defined as up to the age of digital consent in the UK - i.e. 13), rather than whether a service is “likely 
to be accessed by children”. 


IA is happy to work with the ICO on appropriate guidance to help services determine whether they 
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“target” children. For example, definitions from the US COPPA Rule could be of relevance.” Further, 
GDPR itself (e.g. Article 38) speaks of “collection of personal data with regard to children when using 
services directly offered to a child” (emphasis added), which reflects a focus of active intent in targeting 
of services at children. 


2.2 Inconsistency With Data Minimisation Principles 


IA is concerned that the draft Code will result in a significant increase in the amount of data collected by 
companies, and in particular a substantial increase in the amount of children’s data collected. 


The broad application of the draft Code to services that are “likely to be accessed” by children — but 
which in practice may have very few child users — will mean that a wide range of websites will collect 
unnecessary personal information, including ‘hard identifiers’ such as photo ID, which is inconsistent 
with data minimisation principles. 


Further, the guidance on age-appropriate application is at odds with guidance on data minimisation. The 
ICO specifies that in order to ease the burden of essentially creating different services for different 
users, a service should “provide a child-appropriate service to all users by default with the option of 
age-verification mechanism to allow adults to opt out”. As set out in Section 2.1 above, this will result in 
a disproportionate scope, but it also raises concerns in relation to data minimisation. In order to tailor 
design or implement robust age-verification as the draft Code requires, services will need to collect 
additional information on their users that previously was never needed to be collected or stored, 
contradicting the principle of data minimisation. 


Looking at the example of connected toys and devices, the draft Code expressly refers to the need to 
comply when processing data, but offers little guidance as to what is required in this context. The draft 
Code also seeks to require all users to be treated as if children as a default, or to require more complex 
and intrusive processing by potentially requiring, for example in the case of home hubs, the creation of 
individual voice profile accounts, such data being special category biometric data and therefore much 
higher risk than other kinds of preference data. 


Finally on this point, the huge increase in the amount of data collected could actually undermine privacy 
for both adults and children, rather than improve children’s privacy as is intended. In general, there is an 
increased privacy risk should this information be hacked. In relation to children specifically, there are 
increased data protection risks and broader safety risks if children must verify their age to use a Service, 
which will require the collection of additional personal data and evidence. 


2.3 Risk Of Poor Outcomes For Children, And All Internet Users 


IA is concerned that the draft Code will have the unintended consequence of limiting or removing 


2 "Web site or online service directed to children means a commercial Web site or online service, or portion thereof, that is targeted 
to children. 


(1) In determining whether a Web site or online service, or a portion thereof, is directed to children, the Commission will consider 
its subject matter, visual content, use of animated characters or child-oriented activities and incentives, music or other audio 
content, age of models, presence of child celebrities or celebrities who appeal to children, language or other characteristics of the 
Web site or online service, as well as whether advertising promoting or appearing on the Web site or online service is directed to 
children. The Commission will also consider competent and reliable empirical evidence regarding audience composition, and 
evidence regarding the intended audience." 
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children’s access to internet services, made possible through data collection, which provide them with 
significant benefits. It would undermine the business model of many free services by restricting their 
ability to use advertising to fund content. 


As aresult, children may no longer have access to important services such as news and information or 
educational resources. In addition, websites that are unable to develop ‘child-friendly’ services could 
just choose to not provide their services to people under 18 (similar to the example of US news websites 
blocking EU users post-GDPR). Pursuant to the UNCRC, children's rights to privacy must be balanced 
against their rights to freedom of expression, which includes “freedom to seek, receive and impart 
information of all kinds, regardless of frontiers”. IA is concerned that the draft Code does not sufficiently 
balance these important rights. 


The draft Code may also make it harder for children to use the internet safety, and harder for parents to 
manage their child’s online experience. In relation to children, there is a risk that the draft Code 
prevents companies from providing child-friendly services targeted at specific age-groups. The default 
switch-off of geolocation could impact children getting home safely. In relation to parental controls, the 
draft Code may have the unintended consequence of making these important tools less effective by 
making it harder for parents to apply them and/or easier for children to circumnavigate them. 


The draft Code could also create adverse impacts for wider internet users, should it require adults to be 
treated as children in the absence of robust age-verification mechanisms. Although the ICO has set out 
five different "age ranges" of children who may have different design needs, this does not reflect the 
economic reality of technology product build. As drafted, companies caught by the draft Code are 
unlikely to be able to say with confidence that their product is used by one age range only. Companies 
would therefore face a number of sub-optimal choices, for example making the entire product suitable 
for the lowest age range (creating a poor experience for adult and older child users), creating multiple 
versions of the same product with different design features per age bracket, or preventing children from 
using their product entirely. 


2.4 Risk Of Double-Regulation Of Wider Internet Policy Issues 


IA is concerned that the draft Code strays beyond the remit of data and privacy issues and seeks to 
address wider issues, in particular online harms. For example, one of the stated reasons behind the 
proposed prohibition of “nudge techniques” is to prevent “extending the use of services” (i.e. concerns 
about screen-time). The draft Code also states that “profiling, such as content feeds which gradually 
take the child away from their original area of interest into other less suitable content, raise much more 
significant concerns.” (i.e. concerns about potentially harmful content). 


Similarly in relation to health and wellbeing, the draft Code states that services should not use personal 
data in ways that have been shown to be detrimental to children's wellbeing or that go against industry 
codes of practice, and the ICO can take this into account in considering compliance with the Age 
Appropriate Design Code. This has the effect of giving statutory force to non-statutory codes by 
enabling, for example, the ICO to enforce against a service if it does not properly consider the impact of 
the CAP Code on content relating to fat, salt or sugar in foods or other CAP Code matters. Further, the 
draft Code states that services should not process data in ways that have been “formally established” as 
requiring further research or evidence to establish whether or not they are detrimental to the health or 
wellbeing of children. 
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Recommendation: These are wider policy matters related to internet safety and health and wellbeing, 
and are being addressed through other processes such as the government’s Online Harms White 
Paper. IA encourages the ICO to restrict the draft Code to the regulation of data and privacy issues. 


2.5 Further Practical Concerns 


The draft Code suggests that a company would need to evidence that its service was not likely to be 
accessed by children. However, from a practical standpoint this may not prove to be possible. The draft 
Code suggests that a company could provide evidence on the number of children actually using its site — 
however, if a company has not been verifying for age, and has been previously reliant on 
self-declaration, it cannot reasonably provide reliable figures on the number of children on its site. In 
addition, there is a lack of clarity on how companies are likely to be judged on this measure, whether it 
be in absolute terms or as a proportion of their user base. 


Returning to age-verification, there are further practical issues with implementing this solution in 
relation to existing users (as well as for new users). Companies would need to assume existing users 
were not over 18, unless they had previously age-verified the user. In this scenario, companies may 
need to turn off a user’s consents, even if they have been provided these previously. 


In relation to the draft Code’s requirements on “Default Settings”, we are concerned about the provision 
which requires “that children’s personal data is only visible or accessible to other users of the service to 
the extent that the child amends their settings to allow this”. Many online services are intrinsically social 
by nature, and it should be sufficient that this is well understood and / or well-communicated to users 
during sign-up. To additionally require that these features be “default off” seems to be disproportionate 
and to the detriment of user experience. To this end, we encourage the ICO to give further guidance on 
what it considers “a compelling reason for a different setting taking into account the best interests of the 
child” (the exception from the “default off” rule). The draft Code also states that “any settings which 
allow third parties to use personal data have to be activated by the child”, which we believe is unclear (in 
particular what is meant by the term “use”) and not commercially realistic. Many internet services 
cannot run without sharing data with third parties, such as hosting providers, and we believe the ICO 
should give further clarity on this provision. 


3. The Draft Code Will Have A Significant Impact On The Internet Economy, In 
Particular Advertising-Funded Services 


IA economic analysis shows that the internet sector contributes £45 billion to the UK economy each 
year, and is responsible for nearly 80,000 businesses and around 400,000 jobs. IA is concerned that the 
draft Code will reduce this significant economic contribution, in particular through undermining the 
business model of many free services by restricting their ability to use advertising to fund content. There 
would be a consequential negative impact on the media, content and other services enjoyed by people 
in the UK, whether adults or children. 


The impact on the wider UK economy is also concerning, especially given the general economic climate 
in the UK. Calculating the cost to the economy of additional regulation should be a significant factor 
taken into account by the ICO when it finalises the draft Code. The impact would be felt by companies 
large and small but, as is usually the case, regulatory requirements and implementation and compliance 
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costs would disproportionately affect start-ups and smaller businesses. 


From a foreign investment perspective, IA is concerned that the draft Code will create more complex 
and costly regulations for businesses operating in the UK, and that companies will therefore choose to 
invest in other countries with a more proportionate regulatory regime. From a start-up and small 
business perspective, there is equally the risk that companies will choose to establish their businesses 
elsewhere. Economic risk was recognised in the parliamentary debate on DPA18, where in relation to 
the scope of the draft Code Lord Ashton of Hyde stated that “these amendments go further than 
permitted [by GDPR], creating a risk for our future trading relationships” .? 


Overall, IA is therefore concerned that the draft Code will have negative consequences for the UK 
economy. 


4. Process Concerns 


In addition to the substantive concerns with the draft Code set out above, IA is also concerned about the 
process undertaken to date for developing the draft Code and believes that much more consultation is 
needed across industry, the public (including parents and children) and society to consider the best way 
forward. Best practice is for regulators and policymakers to set out a deliberative process of 
consultation and debate with the aim of developing balanced regulation that takes into account a range 
of competing factors, especially when policy or regulation affects such a wide range of companies. IA 
believes that a longer consultation period for the draft Code is needed to achieve a balanced, 
proportionate outcome. 


In addition, the ICO envisages the Code will come into force only 21 days after the date the Code is 
issued. While IA hopes that the ICO will amend the draft Code to take into account the concerns 
expressed in relation to the proposals, if the draft Code is adopted in its current — or even similar — form, 
then IA believes that industry needs a much longer transitional period to enable it to comply with the 
Code. The draft Code has potentially significant business impact on companies large and small — 
potentially requiring companies to set up age-verification or adapt services for use by children. New 
mechanisms and tools will likely need to be built to achieve compliance, and the time needed to 
integrate this into existing products would be considerable. 


Recommendation: There are serious issues with the draft Code, and the immediate focus should be on 
resolving these reasonably. Further ahead, IA believes that a significantly longer implementation 
period — to be determined in further consultation with industry - would be a reasonable means of 
helping to ensure internet companies can continue to provide a wide range of services in the UK while 
also complying with the Code. 


IA also questions the extent to which the draft Code is consistent with parliament’s intent as expressed 
during debate of DPA18. IA’s inference from the debate was that parliament’s intent was for a more 
targeted, proportionate draft Code that addressed child-specific concerns about data and privacy, but 
did not have such a wide-ranging scope — for example capturing services used by adults — or potential 
unintended consequences for internet services used by people (including children) in the UK or the 
wider economic contribution of the internet industry to the UK. Section 123 (1) of DPA18 refers to the 
ICO preparing a code of practice [...] on standards of age-appropriate design of “relevant information 


3 https://hansard.parliament.uk/lords/2017-11-06/debates/107E5465-94B7-4604-981C-1BC49C43FF84/DataProtectionBill(HL 
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society services” (emphasis added) and not of all information society services. IA encourages the ICO to 
reflect further on parliament’s intent in relation to the draft Code. 


Further on process, we are concerned about the low level of consultation with children with respect to 
the draft Code. Under Section 123 (3) of DPA18, the ICO must consult widely on the draft Code, 
including with children, and we are concerned that the research to date has not fully taken into account 
the views of children. While the research undertaken covered over 2000 parents, it only engaged with 
280 children, and an open online survey was completed by only 3 children. The limitation of the 
research with respect to representing the views of children was recognised by the researchers 
themselves. The lack of consultation with children also raises concerns about consistency with the 
UNCRC, which states that children have rights to personal freedoms and to participate in decision 
making — i.e. that they have a right to have their views listened to and to be taken seriously. 


Recommendation: IA is concerned about the apparent absence of a full regulatory impact assessment 
in relation to the draft Code. IA believes that the ICO should undertake a detailed impact assessment 
of its proposals — covering not only technical feasibility and economic impact, but also issues such as 
the impact on privacy and freedom of expression. 


5. Internet Association Regulatory Principles 


IA believes that the ICO should take a more balanced, proportionate approach in developing the draft 
Code. IA has previously set out a number of regulatory principles which it hopes will help policymakers 
and regulators in the UK strike the right balance when considering internet policy and regulation more 
broadly. In the context of the draft Code, the following principles are relevant. 


IA believes that regulation should: 


Be targeted at specific harms, using a risk based approach; 
Provide flexibility to adapt to changing technologies, different services and evolving societal 
expectations; 

e Betechnically possible to implement in practice, and also take into account that resources 
available for this type of activity vary between companies; 

e Provide clarity and certainty for consumers, citizens and internet companies. 


IA encourages the ICO to take these principles into account as it amends the draft Code following the 
consultation period. IA is very happy to meet with ICO officials to discuss how the application of these 
principles could help lead to a more targeted, proportionate Age Appropriate Design Code. 


6. Conclusion 


IA welcomes the opportunity to respond to the ICO’s consultation. IA has a number of concerns with the 
proposed Age Appropriate Design Code — in particular the potential for poorly designed regulation to 
damage the internet economy and prevent people (including children) accessing services that they enjoy 
and find useful. IA is concerned that the application of the regulations will go beyond the intended 
audience of children, and may lead to worse outcomes for children and adults alike. IA is also concerned 
that the potential interaction between the draft Code and other policy processes, such as the 
government’s Online Harms White Paper, has not been fully considered, and more broadly that there 
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has not been sufficient time set aside to consult and discuss the draft Code before implementation. 


IA supports balanced, proportionate regulation that achieves the joint objectives of protecting people 
from harm online and ensuring that the internet can continue to deliver benefits to the economy and 
society. IA has proposed a number of regulatory policy principles which it believes can help deliver this 
outcome, and IA and its members will continue to work with policymakers and regulators on these 
important issues. 


Internet Association 
31 May 2019 
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